Skip to content
Raptor home
Menu

New-tab link without noopener

security.unsafe_cross_origin
Priority
Note
Severity
Info

What we look for

These pages have links with target="_blank" (open in a new tab) and no rel="noopener" or rel="noreferrer", the setting that stops the new page reaching back to this one.

Why it matters

In older browsers, the opened page could send this tab to a fake page. It protects visitors but does not affect search results, so it costs no points.

How to fix

Add rel="noopener" to links that open in a new tab, in the page template or the CMS link settings.

What it cannot know

Current browsers already treat new-tab links as noopener, so the risk is limited to older ones.

Where you’ll see it

The id is stable, and every surface uses it, so it’s the thing to search for or hand to an agent.

Terminal
When it is one of the five findings under Fix first, raptor crawl prints the id under it.
Check: security.unsafe_cross_origin
crawl.json and the CSV
The crawl JSON names the finding by this id, and so do the CSV and raptor_query.
"check_id": "security.unsafe_cross_origin"
The HTML report
This link opens the finding in the report, and each finding shows its id.
crawl.html#finding=security.unsafe_cross_origin
MCP
raptor_findings with this check_id returns the finding in full, with a fix brief ready to paste into a task. If it didn’t fire, it says why.
raptor_findings {
  "job_id": "...",
  "check_id": "security.unsafe_cross_origin"
}